registry / kcgrouter / 0.8.0

kcgrouter@0.8.0

Lightweight AI proxy gateway — route chat completions to upstream providers

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 221 file(s), 1.59 MB of source, external domains: api.anthropic.com, api.commandcode.ai, api.openai.com, api.xiaomimimo.com, api2.qoder.sh, api3.qoder.sh, codewhisperer.us-east-1.amazonaws.com, generativelanguage.googleapis.com, github.com, openapi.qoder.sh, q.us-east-1.amazonaws.com, qoder.com, react.dev, www.w3.org

Source & flagged code

4 flagged

package.jsonView file

Lines 17-57json

17 "bunfig.toml",

18 "tsconfig.json",

19 "!src/**/__tests__/**",

20 "!src/**/*.test.ts",

21 "!src/**/*.test.tsx",

22 "!src/test-setup.ts"

23 ],

24 "engines": {

25 "bun": ">=1.2.3"

26 },

27 "scripts": {

28 "dev": "bun --hot src/index.ts",

29 "start": "NODE_ENV=production bun src/index.ts",

30 "build": "bun run build.ts",

31 "check": "biome check --write ./src",

32 "lint": "biome lint --write ./src",

33 "format": "biome format --write ./src",

34 "gen-env": "bash scripts/gen-env.sh",

35 "generate-icon": "bun scripts/generate-icon.ts",

36 "test": "bash scripts/test.sh",

37 "postinstall": "bun scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 "prepublishOnly": "bun run build"

39 },

40 "dependencies": {

41 "@clack/prompts": "^1.7.0",

42 "@radix-ui/react-label": "^2.1.7",

43 "@radix-ui/react-select": "^2.2.6",

44 "@radix-ui/react-slot": "^1.2.3",

45 "bun-plugin-tailwind": "^0.1.2",

46 "class-variance-authority": "^0.7.1",

47 "clsx": "^2.1.1",

48 "jsonc-parser": "^3.3.1",

49 "lucide-react": "^1",

50 "radix-ui": "^1.6.7",

51 "react": "^19",

52 "react-dom": "^19",

53 "recharts": "^3.10.1",

54 "sonner": "^2.0.7",

55 "systray2": "^2.1.4",

56 "tailwind-merge": "^3.3.1",

57 "tailwindcss": "^4.1.11",

src/server/providers/qoder/cosy.tsView file

Lines 30-70typescript

30 QODER_MACHINE_OS,

31 QODER_MACHINE_TYPE,

32 QODER_RSA_PUBLIC_KEY,

33} from "./constants";

35export interface CosyCreds {

src/db/client.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = kcgrouter@0.6.6 matchedIdentity = npm:a2Nncm91dGVy:0.6.6 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/db/client.tsView on unpkg

Source & flagged code

4 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code